The krb5 child contacts the PAC responder for any user except for the IPA
native users if the PAC is configured. This works fine for the general
case but the ipa_server_mode is a special one. The PAC responder is there,
but since in the server mode we should be operating as AD provider default,
the PAC shouldn't be analyzed either in this case.
It seems that some linkers have problem with wrong order of libraries.
This commit only change order.
Attached patch should fix next issue:
Library libsss_crypt.so is used in linking process, but there are
It seems that I changed order of libraries after rewriting link_all_deplibs
patch to use automake variable SSSD_INTERNAL_LTLIBS. I only tested
new patch with patched version of libtool on fedora.
libtool: link: gcc -Wall -Wshadow -Wstrict-prototypes -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Werror-implicit-function-declaration -fno-strict-aliasing -std=gnu99 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -I/usr/include/samba-4.0 -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -Wl,-Bsymbolic-functions -Wl,-z -Wl,relro -o .libs/sss_ssh_authorizedkeys src/sss_client/sss_ssh_authorizedkeys-common.o src/sss_client/ssh/sss_ssh_authorizedkeys-sss_ssh_client.o src/sss_client/ssh/sss_ssh_authorizedkeys-sss_ssh_authorizedkeys.o -lpthread -ltalloc /usr/lib/x86_64-linux-gnu/libpopt.so ./.libs/libsss_crypt.so ./.libs/libsss_debug.so ./.libs/libsss_child.so ./.libs/libsss_util.so -Wl,-rpath -Wl,/usr/lib/x86_64-linux-gnu/sssd
./.libs/libsss_util.so: undefined reference to `sss_base64_decode'
./.libs/libsss_util.so: undefined reference to `s3crypt_gen_salt'
./.libs/libsss_util.so: undefined reference to `sss_base64_encode'
./.libs/libsss_util.so: undefined reference to `s3crypt_sha512'
collect2: error: ld returned 1 exit status
The FreeIPA team is happy to welcome you to a Fedora Test Day that is
being held on Thursday, July 25th.
We would like to invite you to take part in testing of the upcoming FreeIPA 3.3
release containing 2 major improvements for easier deployment of FreeIPA Active
Directory Trust feature to existing environments:
1) Use POSIX attributes defined in Active Directory 
With previous FreeIPA releases, users coming from Active Directory to FreeIPA
managed machines were always assigned POSIX attributes (UID and GID) by
However, in some deployments, Active Directory users and groups already have
defined custom POSIX attribute values (UID and GID), which may then be
leveraged on Linux machines via other 3rd party Active Directory integration
solutions. Administrator may choose to keep the values to not disrupt file
With FreeIPA 3.3, FreeIPA Active Directory Trust may be configured to use these
attributes when Active Directory user authenticates to Linux machines.
2) Expose POSIX data on legacy systems without recent SSSD
Administrators may have a deployment of machines which cannot use the recent
SSSD with Active Directory Trust support but would still like to be able to
authenticate with Active Directory user to these machines. This may affect for
example older Linux machines, UNIX machines.
With FreeIPA 3.3, Administrator may configure a compatibility LDAP tree which
will contain identities of the Active Directory users to the legacy systems.
These systems may then leverage standard LDAP authentication in this tree
allowing selected Active Directory users to authenticate.
To read more about the Test Day and suggested tests, see the following link:
Thank you for your help and participation!
The FreeIPA team
If the IPA server mode is on and the SSSD is running on the IPA server,
then the server's extdom plugin calls getpwnam_r to read info about trusted
users from the AD server and return them to the clients that called the
The SSSD returns the subdomain users fully-qualified, ie "user@domain"
by default. The format of the fully qualified name is configurable.
However, the extdom plugin returns the user name without the domain
With this patch, when ipa_server_mode is on, warn if the full_name_format
is set to a non-default value. That would prompt the admin to change the
format if he changed it to something exotic.